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Claims 

[d] A network computer system for providing security, 
wherein the network computer system comprises: 
a monitoring function for the network computer system; 
at least one outside server for an untrusted computer 
network, wherein the monitoring function can read and 
execute data from the at least one outside server for the 
untrusted computer network; 

at least one proxy server, wherein the at least one out- 
side server for the untrusted computer network is able to 
read and write data to the at least one proxy server, 
wherein the monitoring function can read and execute 
data from the at least one proxy server; 
at least one inside server, wherein the at least one proxy 
server is able to read and write data to the at least one 
inside server, wherein the monitoring function can read 
and execute data from the at least one inside server; and 
a core operating system that is a portion of an operating 
system, wherein the at least one outside server, the at 
least one proxy server and the at least one inside server 
can read and execute data from the core operating sys- 
tem. 



[c2] The network computer system as set forth in Claim 1, 
wherein the monitoring function includes at least one 
system level auditing function. 

[c3] The network computer system as set forth in Claim 1, 
wherein the at least one system level auditing function 
resides within a first compartment and the at least one 
system level auditing function transports system log 
protocol events, generated by the operating system, 
through the network computer system without providing 
access to the system log protocol events from the at 
least one outside server, the at least one proxy server 
and the at least one inside server. 

[c4] The network computer system as set forth in Claim 1, 

wherein the monitoring function includes at least one in- 
trusion detection system. 

[c5] The network computer system as set forth in Claim 4, 
wherein the at least one intrusion detection system re- 
sides within a second compartment and a third compart- 
ment, wherein the second compartment monitors activity 
and makes comparisons to known patterns that may in- 
dicate an attack on the network computer system and 
the third compartment includes source code for the in- 
trusion detection system, wherein the second compart- 
ment can read and execute data located in the third 



compartment without modification thereof. 

[c6] The network computer system as set forth in Claim 1, 
wherein the monitoring function includes at least one 
system health monitoring tool. 

[c7] The network computer system as set forth in Claim 6, 
wherein the at least one system health monitoring tool 
resides within a fourth compartment and a fifth com- 
partment, wherein the fourth compartment monitors 
health and response time for the network computer sys- 
tem, and the fifth compartment includes source code for 
the system health monitoring tool, wherein the fourth 
compartment can read and execute data located in the 
fifth compartment without modification thereof. 

[c8] The network computer system as set forth in Claim 1, 

wherein the monitoring function includes at least one in- 
tegrity check system. 

[c9] The network computer system as set forth in Claim 8, 
wherein the at least one integrity check system resides 
within a sixth compartment and a seventh compartment, 
wherein the sixth compartment will provide an integrity 
check function to monitor changes to a baseline config- 
uration of the network computer system and the seventh 
compartment includes source code for the integrity de- 



tection system, wherein the sixth compartment can read 
and execute source code located in the seventh com- 
partment without modification thereof. 

[dO] The network computer system as set forth in Claim 1, 

wherein the monitoring function includes the at least one 
system level auditing function, wherein the at least one 
system level auditing function resides within a first com- 
partment and the system level auditing function trans- 
ports system log protocol events, generated by the oper- 
ating system, through the network computer system 
without providing access to the system log protocol 
events from the at least one outside server, the at least 
one proxy server and the at least one inside server and 
the monitoring function includes at least one intrusion 
detection system, wherein the at least one intrusion de- 
tection system resides within a second compartment and 
a third compartment, wherein the second compartment 
monitors activity and makes comparisons to known pat- 
terns that may indicate an attack on the network com- 
puter system and the third compartment includes source 
code for the at least one intrusion detection system, 
wherein the second compartment can read and execute 
data located in the third compartment without modifica- 
tion thereof and wherein at least one system health 
monitoring tool resides within a fourth compartment and 



a fifth compartment, wherein the fourth compartment 
monitors health and response time for the at least one 
outside server, the at least one proxy server and the at 
least one inside server and the fifth compartment in- 
cludes source code for the at least one system health 
monitoring tool, wherein the fourth compartment can 
read and execute data located in the fifth compartment 
without modification thereof and wherein at least one in- 
tegrity check system resides within a sixth compartment 
and a seventh compartment, wherein the sixth compart- 
ment will provide an integrity check function to monitor 
changes to a baseline configuration of the network com- 
puter system and the seventh compartment includes the 
source code for the integrity detection system, wherein 
the sixth compartment can read and execute data lo- 
cated in the seventh compartment without modification 
thereof. 

[cH] The network computer system as set forth in Claim 1, 
wherein the at least one outside server includes at least 
one eighth compartment where outside requests are re- 
ceived, processed, and then passed to the at least one 
proxy server for further processing and at least one 
ninth compartment where source code for the at least 
one outside server resides, wherein the at least one 
eighth compartment can read and execute data from the 



at least one ninth compartment and the at least one 
ninth compartment can read and execute data from the 
core operating system. 

[d2] The network computer system as set forth in Claim 11, 
wherein the source code includes encryption binaries 
and configuration files. 

[d3] The network computer system as set forth in Claim 10, 
wherein the outside server includes at least one eighth 
compartment where outside requests are received, pro- 
cessed, and then passed to the at least one proxy server 
for further processing and at least one ninth compart- 
ment where source code for the at least one outside 
server resides, wherein the at least one eighth compart- 
ment can read and execute data from the at least one 
ninth compartment and the at least one ninth compart- 
ment can read and execute data from the at least one 
core operating system that resides in a fourteenth com- 
partment and the third compartment of the intrusion de- 
tection function, the fifth compartment of the at least 
one system health monitoring tool and the seventh com- 
partment of the at least one integrity check function can 
read and execute data from the at least one eighth com- 
partment for the at least one outside server. 

[d4] The network computer system as set forth in Claim 1, 



wherein the at least one proxy server includes at least 
one tenth compartment where the at least one proxy 
server executes and filters requests from the at least one 
outside server, which are then passed to the at least one 
inside server for further processing and at least one 
eleventh compartment wherein source code for the at 
least one proxy server resides, where the at least one 
tenth compartment can read and execute data from the 
at least one eleventh compartment and the at least one 
eleventh compartment can read and execute data from 
the core operating system. 

[d5] The network computer system as set forth in Claim 14, 
wherein the source code includes binaries and configu- 
ration files. 

[d6] The network computer system as set forth in Claim 14, 
wherein the at least one proxy server makes buffer 
checks and file extension requests to ascertain whether a 
security threat is present. 

[d7] The network computer system as set forth in Claim 10, 
wherein the at least one proxy server includes at least 
one tenth compartment where the at least one proxy 
server executes and filters requests from the at least one 
outside server which are then passed to the at least one 
inside server for further processing and at least one 



eleventh compartment where source code for the at least 
one proxy server resides, wherein the at least one tenth 
compartment can read and execute data from the at 
least one eleventh compartment and the at least one 
eleventh compartment can read and execute data from 
the core operating system, residing in a fourteenth com- 
partment, and the third compartment of the at least one 
intrusion detection function, the fifth compartment of 
the at least one system health monitoring tool and the 
seventh compartment of the at least one integrity check 
function can read and execute data from the at least one 
tenth compartment for the at least one proxy server. 

[d8] The network computer system as set forth in Claim 17, 
wherein the source code includes binaries and configu- 
ration files. 

[d9] The network computer system as set forth in Claim 1, 
wherein the at least one inside server includes at least 
one twelfth compartment where the at least one inside 
server executes all requests received from the untrusted 
computer network that have been screened and deemed 
valid for further processing and at least one thirteenth 
compartment where source code for the at least one in- 
side server resides, wherein the at least one twelfth 
compartment can read and execute data from the at 
least one thirteenth compartment and the at least one 



thirteenth compartment can read and execute data from 
the core operating system. 

[c20] The network computer system as set forth in Claim 10, 
wherein the at least one inside server includes at least 
one twelfth compartment where the at least one inside 
server executes all requests received from the untrusted 
computer network have been screened and deemed valid 
for further processing and at least one thirteenth com- 
partment where binaries and configuration files for the 
at least one inside server reside, wherein the at least one 
thirteenth compartment can read and execute data from 
the core operating system, residing in a fourteenth com- 
partment, and the third compartment of the at least one 
intrusion detection function, the fifth compartment of 
the at least one system health monitoring tool and the 
seventh compartment of the at least one integrity check 
function can read and execute data from the at least one 
twelfth compartment for the at least one inside server. 

[c21] The network computer system as set forth in Claim 1, 

wherein system log protocol events produced by external 
devices can be forwarded through the at least one out- 
side server, the at least one proxy server, and the at 
least one inside server to at least one other software ap- 
plication that monitors security intrusions. 



[c22] The network computer system as set forth in Claim 1, 
wherein external data received from the outside through 
an untrusted computer network can pass from the at 
least one outside server wherein data from the at least 
one outside server can be read and written to the at least 
one proxy server, wherein data from the at least one 
proxy server can be read and written to the at least one 
inside server, wherein data from can at least one inside 
server can be read and written to at least one software 
application for further processing. 

[c23] a network computer system for providing security, 
wherein the network computer system comprises: 
at least one system level auditing function, wherein the 
at least one system level auditing function resides within 
a first compartment and the at least one system level au- 
diting function transports system log protocol events 
produced by an operating system through the network 
computer system; 

at least one intrusion detection system, wherein the at 
least one intrusion detection system resides within a 
second compartment and a third compartment, wherein 
the second compartment monitors activity and makes 
comparisons to known patterns that may indicate an at- 
tack on the network computer system and the third 
compartment is where source code for the intrusion de- 



tection system resides, wherein the second compartment 
can read and execute data located in the third compart- 
ment without modification thereof; 
at least one system health monitoring tool, wherein the 
at least one system health monitoring tool resides within 
a fourth compartment and a fifth compartment, wherein 
the fourth compartment monitors health and response 
time for the at least one outside server, the at least one 
proxy server and the at least one inside server and the 
fifth compartment is where source code for the system 
health monitoring tool resides, wherein the fourth com- 
partment can read and execute data located in the fifth 
compartment without modification thereof; 
at least one integrity check system, wherein the at least 
one integrity check system resides within a sixth com- 
partment and a seventh compartment, wherein the sixth 
compartment will provide an integrity check function to 
monitor changes to a baseline configuration of the net- 
work computer system and the seventh compartment is 
where source code for the integrity check system re- 
sides, wherein the sixth compartment can read and exe- 
cute the source code located in the seventh compart- 
ment without modification thereof; 
at least one core operating system, residing within a 
fourteenth compartment; 

at least one outside server for an untrusted computer 



system, wherein the outside server includes at least one 
eighth compartment where outside requests are received 
and processed and at least one ninth compartment 
where source code for the at least one outside server re- 
sides, wherein the at least one eighth compartment can 
read and execute data from the at least one ninth com- 
partment and the at least one ninth compartment can 
read and execute data from the at least one core operat- 
ing system that resides in the fourteenth compartment 
and the third compartment of the at least one intrusion 
detection function, the fifth compartment of the at least 
one system health monitoring tool and the seventh com- 
partment of the at least one integrity check function can 
read and execute data from the at least one outside 
server; 

at least one proxy server, wherein the at least one proxy 
server includes at least one tenth compartment where 
the at least one proxy server executes and filters re- 
quests from the at least one outside server and at least 
one eleventh compartment where source code for the at 
least one proxy server resides, wherein the at least one 
tenth compartment can read and execute data from the 
at least one eleventh compartment and the at least one 
eleventh compartment can read and execute data from 
the at least one core operating system, residing in the 
fourteenth compartment, and the third compartment of 



the at least one intrusion detection function, the fifth 
compartment of the at least one system health monitor- 
ing tool and the seventh compartment of the at least one 
integrity check function can read and execute data from 
the at least one proxy server; and 
wherein the at least one inside server includes at least 
one twelfth compartment where the at least one inside 
server executes all and requests received from the unse- 
cured computer network have been screened and 
deemed valid for further processing by the at least one 
proxy server and at least one thirteenth compartment 
where source code for the at least one inside server re- 
sides, wherein the at least one twelfth compartment can 
read and execute data from the at least one thirteenth 
compartment and the at least one thirteenth compart- 
ment can read and execute data from the at least one 
core operating system, residing in the fourteenth com- 
partment, and the third compartment of the at least one 
intrusion detection function, the fifth compartment of 
the at least one system health monitoring tool and the 
seventh compartment of the at least one integrity check 
function can read and execute data from the at least one 
inside server. 

[c24] The network computer system as set forth in Claim 23, 
wherein system log protocol events produced by external 



devices can be forwarded through the at least one out- 
side server, the at least one proxy server, and the at 
least one inside server to at least one other software ap- 
plication that monitors security intrusions. 

[c25] The network computer system as set forth in Claim 23, 
wherein data from the untrusted computer network can 
pass from the at least one outside server wherein data 
from at least one outside server can be read and written 
to the at least one proxy server, where data from at least 
one proxy server can be read and written to the at least 
one inside server, wherein data from can at least one in- 
side server can be read and written to at least one soft- 
ware application for further processing. 

[c26] a process for providing security to a network computer 
system comprising: 

reading and executing data from at least one outside 
server for an untrusted computer network with a moni- 
toring function; 

reading and executing data from at least one proxy 
server for an untrusted computer network with the mon- 
itoring function; 

reading and executing data from at least one inside 
server for an untrusted computer network with the mon- 
itoring function; 

reading and writing data from the at least one outside 



server to the at least one proxy server; 
reading and writing data from the at least one proxy 
server to the at least one inside server; and 
reading and executing data from a core operating sys- 
tem, which is at least a portion of an operating system, 
with the at least one outside server, the at least one 
proxy server and the at least one inside server. 

[c27] The process for providing security to a network com- 
puter system as set forth in Claim 26, wherein the moni- 
toring function includes auditing of the network com- 
puter system. 

[c28] The process for providing security to a network com- 
puter system as set forth in Claim 27, wherein the audit- 
ing of the network computer system, within a first com- 
partment, includes transporting system log protocol 
events, generated by the operating system, through the 
network computer system without providing access to 
the system log protocol events from the at least one out- 
side server, the at least one proxy server and the at least 
one inside server. 

[c29] The process for providing security to a network com- 
puter system as set forth in Claim 26, wherein the moni- 
toring function includes detecting of intrusions in the 
network computer system. 



[c30] The process for providing security to a network com- 
puter system as set forth in Claim 29, wherein the de- 
tecting of intrusions includes monitoring activity and 
making comparisons to known patterns that may indi- 
cate an attack on the network computer system within at 
least one second compartment and providing source 
code for the monitoring activity and making comparisons 
to known patterns that may indicate an attack on the 
network computer system within at least one third com- 
partment and reading and executing data located in the 
at least one third compartment from the at least one 
second compartment. 

[c31] The process for providing security to a network com- 
puter system as set forth in Claim 26, wherein the moni- 
toring function includes monitoring health of the net- 
work computer system. 

[c32] The process for providing security to a network com- 
puter system as set forth in Claim 31, wherein the moni- 
toring health of the network computer system includes 
monitoring health and response time for the network 
computer system, within at least one fourth compart- 
ment, and providing source code for monitoring health 
and response time for the network computer system, 
within at least one fifth compartment, wherein the at 



least one fourth compartment can read and execute data 
located in the at least one fifth compartment. 

[c33] The process for providing security to a network com- 
puter system as set forth in Claim 26, wherein the moni- 
toring function includes checking of integrity of the net- 
work computer system. 

[c34] The process for providing security to a network com- 
puter system as set forth in Claim 33, wherein the 
checking of integrity of the network computer system in- 
cludes monitoring changes to a baseline configuration of 
the network computer system, within the at least one 
sixth compartment, and providing source code for moni- 
toring changes to a baseline configuration of the net- 
work computer system, within the at least one seventh 
compartment, wherein the at least one sixth compart- 
ment can read and execute data located in the at least 
one seventh compartment. 

[c35] The process for providing security to a network com- 
puter system as set forth in Claim 26, wherein the re- 
ceiving of outside requests from the at least one outside 
server for an untrusted computer network is with the at 
least one eighth compartment and providing source code 
for receiving of outside requests from the at least one 
outside server for the untrusted computer network is 



with the at least one ninth compartment, wherein the at 
least one eighth compartment can read and execute data 
located in the at least one ninth compartment. 

[c36] The process for providing security to a network com- 
puter system as set forth in Claim 26, wherein the read- 
ing and writing of data to the at least one proxy server is 
where the at least one proxy server executes and filters 
requests from the at least one outside server with the at 
least one tenth compartment and the source code for the 
reading and writing of data to the at least one proxy 
server is where the at least one proxy server executes 
and filters requests from the at least one outside server 
is with the at least one eleventh compartment, wherein 
the at least one tenth compartment can read and execute 
data from the at least one eleventh compartment. 

[c37] The process for providing security to a network com- 
puter system as set forth in Claim 26, wherein the read- 
ing and writing of data to the at least one inside server 
from the at least one proxy server is with the at least one 
twelfth compartment where the at least one inside server 
executes all requests received from the untrusted com- 
puter network have been screened and deemed valid for 
further processing and the at least one thirteenth com- 
partment where source code for the at least one inside 
server resides, wherein the at least one twelfth compart- 



ment can read and execute data from the at least one 
thirteenth compartment. 

[c38] The process for providing security to a network com- 
puter system as set forth in Claim 26, further comprising 
forwarding system log protocol events produced by ex- 
ternal devices through the at least one outside server, 
the at least one proxy server, and the at least one inside 
server to the at least one other software application that 
monitors security intrusions. 

[c39] The process for providing security to a network com- 
puter system as set forth in Claim 26, further compris- 
ing: 

passing data from the outside through an untrusted 
computer network to the at least one outside server; 
reading and writing data from the at least one outside 
server to the at least one proxy server; 
reading and writing data from the at least one proxy 
server to the at least one inside server; and 
reading and writing data from the at least one inside 
server to at least one software application for further 
processing. 

[c40] a process for providing security for a network computer 
system comprising: 

utilizing a system level auditing function, wherein the 



system level auditing function resides within a first com- 
partment; 

transporting system log protocol events produced by an 
operating system through the network computer system 
with the system level auditing function; 
utilizing an intrusion detection system, wherein the in- 
trusion detection system resides within a second com- 
partment and a third compartment, wherein the third 
compartment includes source code for the intrusion de- 
tection system; 

inspecting network activity and making comparisons to 
known patterns that may indicate an attack on the net- 
work computer system with the second compartment of 
the intrusion detection system; 

reading and executing data located in the third compart- 
ment with the second compartment of the intrusion de- 
tection system; 

utilizing a system health monitoring tool, wherein the 
system health monitoring tool resides within a fourth 
compartment and a fifth compartment, wherein the fifth 
compartment includes source code for the system health 
monitoring tool; 

monitoring health and response time for the network 
computer system with the fourth compartment of the 
system health monitoring tool; 

reading and executing data located in the fifth compart- 



ment with the fourth compartment of the system health 
monitoring tool; 

utilizing an integrity check system, wherein the integrity 
check system resides within a sixth compartment and a 
seventh compartment; 

monitoring changes to a baseline configuration of the 
network computer system with the sixth compartment; 
reading and executing source code located in the sev- 
enth compartment with the sixth compartment; 
providing a core operating system residing within a four- 
teenth compartment; 

receiving a processing outside requests with at least one 
outside server for an untrusted computer network, 
wherein the at least one outside server includes at least 
one eighth compartment where outside requests are re- 
ceived and processed and at least one ninth compart- 
ment includes source code for the at least one outside 
server; 

reading and executing data from the at least one ninth 
compartment with at least one eighth compartment; 
reading and executing data from the fourteenth com- 
partment with at least one ninth compartment; 
reading and executing data from the at least one eighth 
compartment for the at least one outside server with the 
third compartment of the intrusion detection system, the 
fifth compartment of the system health monitoring tool 



and the seventh compartment of the check system; 
executing and filtering requests from the at least one 
outside server to the at least one proxy server, wherein 
the at least one proxy server includes at least one tenth 
compartment where the at least one proxy server exe- 
cutes and filters requests from the at least one outside 
server and at least one eleventh compartment includes 
source code for the at least one proxy server; 
reading and executing data from the fourteenth com- 
partment with at least one eleventh compartment; 
reading and executing data from the at least one tenth 
compartment for the at least one proxy server with the 
third compartment of the intrusion detection system, the 
fifth compartment of the system health monitoring tool 
and the seventh compartment of the check system; 
executing requests received from the untrusted com- 
puter network have been screened and deemed valid for 
further processing by the at least one proxy server with 
at least one twelfth compartment for the at least one in- 
side server and at least one thirteenth compartment in- 
cludes source code for the at least one inside server; 
reading and executing data from the fourteenth com- 
partment with the at least one thirteenth compartment; 
and 

reading and executing data from the at least one twelfth 
compartment for the at least one inside server with the 



third compartment of the intrusion detection system, 
fifth compartment of the system health monitoring tool 
and the seventh compartment of the check system. 

[c41] The network computer system as set forth in Claim 40, 
further comprising forwarding system log protocol 
events produced by external devices through the at least 
one outside server, the at least one proxy server, and the 
at least one inside server to the at least one other soft- 
ware application that monitors security intrusions. 

[c42] The network computer system as set forth in Claim 40, 
further comprising reading and writing data from the at 
least one inside server can be read and write to at least 
one software application for further processing. 



